virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for
Linux on numerous hardware platforms. The virt:rhel module contains packages
which provide user-space components used to run virtual machines using KVM. The
packages also provide APIs for managing and interacting with the virtualized
systems.

Security Fix(es):

* ntfs-3g: heap-based buffer overflow in ntfsck (CVE-2021-46790)
* QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU
exhaustion (CVE-2022-3165)
* ntfs-3g: crafted NTFS image can cause heap exhaustion in
ntfs_get_attribute_value (CVE-2022-30784)
* ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in
ntfs_names_full_collate (CVE-2022-30786)
* ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in
ntfs_mft_rec_alloc (CVE-2022-30788)
* ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in
ntfs_check_log_client_array (CVE-2022-30789)
* tpm2: TCG TPM2.0 implementations vulnerable to memory corruption
(CVE-2023-1018)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2021-46790
ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving
buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated;
however, it is shipped by some Linux distributions.
CVE-2022-3165
An integer underflow issue was found in the QEMU VNC server while processing
ClientCutText messages in the extended format. A malicious client could use this
flaw to make QEMU unresponsive by sending a specially crafted payload message,
resulting in a denial of service.
CVE-2022-30784
A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in
NTFS-3G through 2021.8.22.
CVE-2022-30786
A crafted NTFS image can cause a heap-based buffer overflow in
ntfs_names_full_collate in NTFS-3G through 2021.8.22.
CVE-2022-30788
A crafted NTFS image can cause a heap-based buffer overflow in
ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
CVE-2022-30789
A crafted NTFS image can cause a heap-based buffer overflow in
ntfs_check_log_client_array in NTFS-3G through 2021.8.22.
CVE-2023-1018
An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a
2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption
routine. An attacker who can successfully exploit this vulnerability can read or
access sensitive data stored in the TPM.

Modularity name: virt
Stream name: rhel